7.8

CVE-2026-89733

usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < 85dd5e8bd6776d02854f2847d83429f1f712e99c
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < 502a7f5b79b7ba751988789e982924f8f496129f
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < bec7708eb3b5295d12e931db24381b7c94c72953
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < 8e88ed8a374de67270d38689f2a81018909cafbb
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < 9897b7da8c0ad8356c1b8649379fcb5a689462cb
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < 38f822ddce9355893d734279a26ddec45182197e
Status affected
Version 0f9df939385527049c8062a099fbfa1479fe7ce0
Version < bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc
Status affected
Version 1efa8a5aac93d9e67075995d7d4902b57ce184f7
Status affected
Version e7a4b0efe62e56a0acc81d16091c6efc2a282be8
Status affected
Version 065f5561a20659cf17aae5f72b32b5c2695c8e00
Status affected
Version 3.2.36
Version < 3.3
Status affected
Version 3.4.25
Version < 3.5
Status affected
Version 3.7.2
Version < 3.8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.8
Status affected
Version 0
Version < 3.8
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.109
Status unaffected
Version <= 6.18.*
Version 6.18.50
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.059
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/8e88ed8a374de67270d38689f2a81018909cafbb
https://git.kernel.org/stable/c/9897b7da8c0ad8356c1b8649379fcb5a689462cb
https://git.kernel.org/stable/c/38f822ddce9355893d734279a26ddec45182197e
https://git.kernel.org/stable/c/bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc
https://git.kernel.org/stable/c/502a7f5b79b7ba751988789e982924f8f496129f
https://git.kernel.org/stable/c/85dd5e8bd6776d02854f2847d83429f1f712e99c
https://git.kernel.org/stable/c/bec7708eb3b5295d12e931db24381b7c94c72953
https://git.kernel.org/stable/c/ddb1b0d5d858584ed0d3a5aaa042ee693998c7e2